Security

Last updated: October 19, 2026

1. Overview

LLMIntel takes security seriously. This page describes our security practices and the measures we take to protect your data.

2. Data Flow

2.1 What We Collect

Telemetry SDK: Collects metadata only:

• Model identifiers (e.g., "gpt-4o", "claude-sonnet-5.5")
• Token counts (input and output)
• Timestamps
• Optional environment tags

We never collect prompts, completions, or any user-generated content.

2.2 Data Storage

• Database: Neon Postgres (AWS us-east-1)
• Hosting: Vercel (serverless, globally distributed)
• Email: Resend
• Payments: Stripe (PCI DSS compliant)

3. Security Measures

3.1 Encryption

• In Transit: TLS 1.2+ for all connections
• At Rest: Encrypted database storage via Neon
• Secrets: Environment variables, never committed to source control

3.2 Authentication

• Better Auth for user sessions (httpOnly cookies)
• API keys use SHA-256 hashing (raw keys never stored)
• OAuth support for Google, GitHub, Microsoft

3.3 Access Control

• Role-based access controls
• Principle of least privilege
• Database connections from Vercel functions only

3.4 Monitoring

• Application logs (no sensitive data logged)
• Rate limiting to prevent abuse
• Webhook signature verification

4. Third-Party Security

4.1 Subprocessors

We rely on SOC 2 compliant vendors:

• Neon: SOC 2 Type II certified database
• Vercel: SOC 2 Type II certified hosting
• Stripe: PCI DSS Level 1 certified payments
• Resend: Transactional email service

4.2 No Third-Party Analytics

We do not use Google Analytics, Facebook Pixel, or other third-party tracking scripts. Usage analytics are first-party only (Vercel Analytics, metadata).

5. Data Retention

• Telemetry: 1-13 months depending on your plan
• Account data: Retained while account is active
• Anonymous API logs: Hashed IPs pruned after each minute window
• Deleted accounts: Personal data removed within 30 days

6. Compliance

• PIPEDA: Canadian privacy legislation (operator based in Ontario)
• GDPR: Data subject rights supported (access, deletion, export)
• CCPA: California consumer privacy rights supported

7. Vulnerability Disclosure

If you discover a security vulnerability, please report it responsibly:

• Email: security@llmintel.ai
• Do not publicly disclose the issue before we have addressed it
• Provide sufficient detail for us to reproduce the issue
• We aim to respond within 48 hours

8. Data Breach Response

In the event of a data breach, we will:

• Contain and investigate the incident
• Notify affected users within 72 hours
• Report to relevant authorities as required by law
• Implement remediation measures

9. Questions

For security questions, contact:
Email: security@llmintel.ai or support@llmintel.ai
Operator: Alex Tsimbalistov / LLMIntel
Location: Oakville, Ontario, Canada